Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 14:53
Behavioral task
behavioral1
Sample
770d615b23a5e418ee1023715baae5df.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
770d615b23a5e418ee1023715baae5df.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
770d615b23a5e418ee1023715baae5df.dll
-
Size
61KB
-
MD5
770d615b23a5e418ee1023715baae5df
-
SHA1
8c5be7243e631073690c7f9dc69b54a0c8cff29e
-
SHA256
2d0aa9b8fefda4cd54034b650915d9a567f20431d6ed769b6f6bdc4b734d9ca7
-
SHA512
5888dffde2a6c8d192b593e2f1a132469b1d7cc6dc52feca242262d96d8348879853e20cf7c75f3b4a65bafaf09235b53396057c5a54cd1a5b4b1ece3c9d14a2
-
SSDEEP
1536:DWJMe+4fuiYSa5sGvO0ag6vwpyUck9Cvt4sligE5lpTv:EMOf/iaIyDk9Cvu4HKH
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5100-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2248 wrote to memory of 5100 2248 rundll32.exe 88 PID 2248 wrote to memory of 5100 2248 rundll32.exe 88 PID 2248 wrote to memory of 5100 2248 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\770d615b23a5e418ee1023715baae5df.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\770d615b23a5e418ee1023715baae5df.dll,#12⤵PID:5100
-